network architecture or the training techniques, the other way is to preprocess an input before feeding samples into the network. In the first category, the most widely used approach so far is adversarial training [1]}, where adversarial examples are added to the training set and the network is trained not to be fooled by them. But to successfully defend against orchestrated attacks, a vast amount of training data are necessary. Methods belonging to the second category are for instance using JPEG compression
[2]},
adding noise to images, or just detecting attacked images. Many detection methods based on PCA [3]}, [4]} or other statistical properties have been introduced, but often they have been found to be only effective on simple problems like the MNIST dataset [5]}.
